2 December 2026: the EU AI Act deadlines the Omnibus did not move.

Regulation (EU) 2026/1744 is remembered on this desk as the act that moved the high-risk deadline. That is the smaller half of what it did. It also added a prohibition, shortened a transitional period, and moved a sandbox obligation, and each of those changes carries a date of its own. Read alongside the revised Product Liability Directive, which the Omnibus does not touch at all, the result is a cluster of three obligations inside nine days of December 2026, sitting exactly one year before the deadline most organisations have written in their calendars.

Section 1. What the Omnibus actually did, in five parts

The Digital Omnibus on AI began as COM(2025) 836, presented on 19 November 2025 as a targeted amendment to Regulation (EU) 2024/1689. It reached political agreement on 7 May 2026, received final Council approval on 29 June 2026, and entered into force on 27 July 2026, six days before the original high-risk application date. The adopted act is Regulation (EU) 2026/1744.

Public coverage of that passage concentrated almost entirely on the deferral, which is understandable: the deferral was the contested question for eight months and it is the change with the largest immediate operational consequence. But the adopted act made five distinct changes, and four of them create or move dates. Set out plainly:

Two further changes carry no new date but matter for how the rest reads. The Omnibus simplified the registration of exempted systems in the EU database, and it extended AI Office oversight to certain systems built on general-purpose models and embedded in very large online platforms and search engines. It also amended Article 4 on AI literacy, which is covered separately below.

Section 2. The new prohibitions, and why they behave differently from everything else

The Omnibus added a prohibition. That is an unusual thing for an act granting a deferral to do, and it deserves more attention than it has received. Two categories of system are now prohibited: AI systems that generate child sexual abuse material, and AI systems that depict an identifiable person's intimate parts without consent. Systems already on the market have until 2 December 2026 to comply.

A prohibition is structurally unlike every other obligation in this regulation, and organisations that have spent two years building documentation practices should register the difference clearly. The high-risk regime under Articles 9 to 17 and Article 26 is a regime of conditions: it permits the activity provided the operator does specified things and can evidence having done them. A prohibition permits nothing. There is no risk management system, no oversight register and no technical file that converts a prohibited practice into a lawful one. The compliance question is binary, and it is answered by inspecting what the system can produce rather than by inspecting what the organisation wrote down about it.

The Article 99 penalty structure reflects that difference in kind. Infringement of the Article 5 prohibitions attracts the top ceiling, up to EUR 35,000,000 or 7 per cent of total worldwide annual turnover, whichever is higher. Other operator obligations sit at up to EUR 15,000,000 or 3 per cent, and supplying incorrect, incomplete or misleading information at up to EUR 7,500,000 or 1 per cent. For small and medium-sized enterprises and start-ups the applicable ceiling is the lower of the two figures in each pair rather than the higher. National market surveillance authorities enforce this regime. A separate regime under Article 101 applies to providers of general-purpose AI models, capped at 3 per cent of annual total worldwide turnover or EUR 15,000,000, whichever is higher. That second regime sits with the AI Office.

The practical question for a European deployer is narrower than the prohibition sounds. Most organisations do not deploy systems whose purpose is anything of this kind. The exposure, where it exists at all, is in general-purpose image and video generation capability that has been embedded into a product or made available to staff or customers without an assessment of what it will produce when asked. That is a capability question, not a policy question, and it is answered by testing rather than by reading a vendor's acceptable use policy. Organisations offering any generative image or video capability to external users should treat the period between now and 2 December 2026 as the window to establish and record what their deployment can and cannot generate.

Section 3. Article 50(2): the transitional period that got shorter, not longer

This is the change most likely to be recorded wrongly, because it moved in the opposite direction to the headline.

Article 50 of Regulation (EU) 2024/1689 sets the transparency obligations. They applied from 2 August 2026 and they were not deferred by the Omnibus. Article 50(2) is the machine-readable marking limb: providers of AI systems generating synthetic audio, image, video or text content must ensure the outputs are marked in a machine-readable format and detectable as artificially generated or manipulated. The Commission's Omnibus proposal attached a transitional period to that duty running to 2 February 2027. The adopted act shortened it. It ends on 2 December 2026.

There is a specific reason this matters more than a two-month difference usually would. The February 2027 figure was live on this site, and on a great deal of other published material, during the period between proposal and adoption. It was accurate when written and became wrong on 27 July 2026 without anything visible happening to the page carrying it. Anyone whose Article 50 planning was set during that window, and not revisited since, is likely to be working to a date that exists only in a superseded proposal. If a marking implementation plan in your organisation names February 2027, that plan was built from the proposal rather than from the act.

Article 50 splits along the provider and deployer line more sharply than most of the regulation. The marking duty in Article 50(2) sits on providers of generative systems. The disclosure duties reach deployers: a person interacting with an AI system should be told, and certain generated or manipulated content should be disclosed as such. An organisation that buys a generative capability and puts it in front of customers is typically a deployer for disclosure purposes and not a provider for marking purposes, unless it has modified the system in a way that shifts its role under Article 25. The full treatment of that boundary is on this site in the Article 25 value chain guide, and the transparency duties themselves in the Article 50 deployer guide.

The fourth column is the one that produces surprises. Marking applied by a model provider does not necessarily survive re-encoding, cropping, format conversion, or passage through a content management system. An organisation relying on an upstream provider's marking should confirm that the marking is still present in what its own users actually receive, and should do that before December rather than after a supervisor asks.

Section 4. 9 December 2026: the deadline outside the AI Act entirely

Directive (EU) 2024/2853 on liability for defective products must be transposed into national law by every Member State by 9 December 2026. It sits outside Regulation (EU) 2024/1689, outside the Omnibus, and outside any part of the negotiation that produced the deferral. No proposal before the Parliament, the Council or the Commission moves it.

The reason it belongs in a December 2026 briefing rather than in a separate one is the reading error that follows from treating the Omnibus as general relief. An organisation that concluded in late July that its AI liability exposure had moved to 2027 has, without noticing, also concluded something about a directive the Omnibus does not touch. Once transposed, AI software falls within the product liability regime, and the evidentiary provisions matter as much as the substantive ones: a claimant's ability to obtain disclosure of evidence from a defendant reaches the documentation an organisation kept about how its system was built, monitored and corrected.

This produces the counterintuitive result at the centre of the current European position. The Article 26 documentation set, whose regulatory deadline moved out by sixteen months, is also the evidentiary record that becomes relevant in a product liability claim from December 2026 onward. The regulatory clock moved. The litigation clock did not. An organisation that stood down its documentation programme in July on the strength of the deferral has reduced its regulatory exposure for 2027 and increased its evidential exposure for 2027, which is not the trade most boards think they made. The interaction is treated at length in the double-exposure guide on this site.

Section 5. What was never deferred, and is enforceable today

The Omnibus deferred two obligation sets. It is worth stating the remainder as a list, because the deferral has been read in a great many places as broader than it is.

The Article 4 amendment is the subtlest of these and the easiest to misread in either direction. AI literacy remains an obligation on providers and deployers. What the Omnibus removed was the mandating of a specific or sufficient level, with the Commission and Member States taking a stronger role in promoting literacy instead. For a deployer of a high-risk system, the duty to train staff so that human oversight is real remains in place. Supervision and enforcement of it commenced on 2 August 2026, with the national market surveillance authorities. Two readings are wrong: that Article 4 was untouched, and that it was repealed. Both have appeared in circulation. The certification consequences of the amendment, specifically what training evidence an assessment can still ask for when the yardstick has been removed, are treated on agentcertified.eu.

Section 6. A working calendar from here

The useful output of all of this is a single ordered list. What follows is the sequence this desk would work in an organisation that has done nothing since July.